HowTo: ReACLing a File Server in a Domain Migration with SetACL 3.0

When you are planning a migration of user accounts between domains one tasks always pops up pretty quickly: reassigning the permissions of the users in the source domain to the corresponding users in the target domain, in other words reACLing the file server.

Migration – the Simple Way

SetACL, the free permissions management command line tool, has had a function to automate that task for a long time. Its domain action allows you to simply copy all permissions from a source domain to a target domain:

This copies permissions for all files and directories below D:\Data from MyOldDomain to MyNewDomain.

This approach is easy and works very well, but, as always, there is a catch: it can be used only if the user names do not change in the migration. Unfortunately, this is not always the case. Organizations tend to use occasions like a migration to thoroughly spring-clean their account naming convention (“since we’re migrating anyway we might as well change the names, too!”). Or you might be involved in a more complex migration where multiple domains are consolidated. Or you just want more control over the reACLing process. Until yesterday, you had to put your scripting hat on and start hacking away to solve the more advanced scenarios. With the release of SetACL 3 this is not necessary any more.

Migration – the Flexible Way

SetACL 3 comes with a more flexible way of handling permissions migrations. Its enhanced migration engine can be used to migrate intra-domain, inter-domain or any mix of the two. To start a migration using the flexible model use a command line similar to the following:

This instructs SetACL to copy permissions between individual users or groups for the D:\Data directory tree. Which accounts the migrations is performed for is read from a simple CSV file, mappings.csv in the example, whose contents might look like this:

As you can see, the system is flexible, powerful and easy to use. All you have to do is create a mapping table pairing old account with new account. If you do not want to do that or if you think it is just too much bother: the simpler method presented above still works and is still considered useful in many scenarios.

We ran this command, although on a directory with many subfolders (200+) it did not work, so we ran a powershell foreach command to get around that. It successfully copies the user, but none of the actual permissions are checked… parameter we missed?

How do you create a mapping file for migrated users from 1 domain to another with the same SID? Is there a tool or command that can parse both domains and match up the SIDS but export the domain1 and domain2 usernames?

Just trying to get my head around this powerful tool. I have used the example to migrate from one domain to another:
SetACL.exe -on “\\server1\share1\users” -ot file -actn domain
-rec cont_obj
-dom “n1:domain1;n2:domain2;da:repldom;w:dacl”
When I run the command:
SetACL.exe -on “\\server1\u$\Shared” -ot file –actn domain -rec cont_obj -dom “n1:domain 1;n2:domain 2;da:repldom;w:d,o” –log “C:\temp\SetACLReset.txt”

Receive the error message: Error in command line: Invalid option specified: -actn! I have used a similar command to get a backup and it works fine. I just can’t work out where this command is wrong! I am sure it is a simple error somewhere!
Appreciate your assistance. Thank you.

Good news is, it does add the group from MyNewDomain to the folder and subfolders of d:\test, but, the permissions of the new addition did not match the permissions of the group from MyOldDomain.
MyOldDomain has a group called ACCOUNTING
MyNewDomain also has a group called ACCOUNTING.

ACCOUNTING has modify access. But, when running this command, the new domain ACCOUNTING’s permissions was set to special, not modify.. Do you have a fix for this?

I really love this tools! Unfortunately there are few bugs in the DOMAIN action:
1) without trust is trying to reach the domain controllers from other domains using NETBIOS name instead of the FQDN.
Workaround: use the DNS search suffixes

2) Migration of the ACEs from Domain1 to Domain2 is changing the perm. ex: List -> Modified and more!

DO NOT USE DOMAIN ACTION!

@Helge how we could help you to fix your tool? Donations? :) Source Code Sharing?

It does not keep the same source permission to target folder during cpydom. Is there any option to correct this? Also, I am looking to. Export the source permission and modify the access and restore with new domain. Is there any option to enable the inheritance only for files, not for for folders .Icalcs is not working to enable the inheritance on file level.